CVE-2026-89687 (GCVE-0-2026-89687)
Vulnerability from cvelistv5
Published
2026-09-11 19:46
Modified
2026-10-19 08:51
Severity ?
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: nfsd: ensure nfsd_file_do_acquire() does not use a non-opened file ->atomic_open is permitted to return success without actually opening the file. It indicates this by calling finish_no_open(). This means dentry_create() can return a file which hasn't been opened. This is extremely unlikely as ->atomic_open handlers typically use finish_no_open() only for already existing files, and dentry_create() isn't called in that case, and the parent being locked should prevent races. However out of an abundance of caution it seems wise to teach nfsd to only use the file returned by dentry_create() if FMODE_OPENED is set, indicating that it has in fact been opened.
References
Impacted products
Vendor Product Version
Linux Linux Version: 64a989dbd144e0622371396461b11335459692d2
Version: 64a989dbd144e0622371396461b11335459692d2
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/filecache.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a95a1cffacd0203100297001719160160f443dd6",
              "status": "affected",
              "version": "64a989dbd144e0622371396461b11335459692d2",
              "versionType": "git"
            },
            {
              "lessThan": "5859cc01fee06a2cd7458905a9593082fbab06e1",
              "status": "affected",
              "version": "64a989dbd144e0622371396461b11335459692d2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/filecache.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7.0"
            },
            {
              "lessThan": "7.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "7.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "7.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: ensure nfsd_file_do_acquire() does not use a non-opened file\n\n-\u003eatomic_open is permitted to return success without actually opening\nthe file.  It indicates this by calling finish_no_open().\nThis means dentry_create() can return a file which hasn\u0027t been opened.\nThis is extremely unlikely as -\u003eatomic_open handlers typically\nuse finish_no_open() only for already existing files, and dentry_create()\nisn\u0027t called in that case, and the parent being locked should prevent\nraces.\n\nHowever out of an abundance of caution it seems wise to teach nfsd to\nonly use the file returned by dentry_create() if FMODE_OPENED is set,\nindicating that it has in fact been opened."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - nfsd is a network NFS server. The bug is in the NFSv4 OPEN+CREATE path (nfsd4_vfs_create \u2192 dentry_create \u2192 nfsd_file_acquire_opened), reached by a remote client sending COMPOUND operations over TCP/2049.\nAC:L - Filesystems whose -\u003eatomic_open creates then calls finish_no_open (notably FUSE when FUSE_CREATE is unimplemented) reliably return an unopened struct file; the attacker only sends a normal OPEN with CREATE and does not depend on an uncontrolled race.\nPR:N - Default nfsd deployments accept AUTH_SYS, which does not cryptographically authenticate the peer. An unauthenticated network attacker who can reach a writable export can spoof a UID and issue OPEN+CREATE with no credentials.\nUI:N - Exploitation uses only attacker-sent NFSv4 requests (clientid/session setup, PUTFH, OPEN with CREATE). No victim action such as mounting a filesystem or opening a file is required.\nS:U - Impact is a kernel oops in the nfsd worker on the host. That is denial of service within the same kernel security authority, not a VM, IOMMU, or sandbox escape.\nC:N - The unused file is allocated via alloc_empty_file with f_op, f_mapping, and f_inode set to NULL. Later use is a NULL-pointer dereference that oopses and does not provide a read primitive or information disclosure.\nI:N - This is not a use-after-free, OOB write, or type confusion; the struct file is valid but never opened, so f_op stays NULL. There is no write primitive or control-flow hijack, only a crash.\nA:H - Caching the unopened file NULL-dereferences f_mapping in nfsd_file_check_write_error on write opens, or f_op on later READ/WRITE/close (vfs_iocb_iter_read, filp_flush), oopsing the nfsd thread and denying NFS service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T08:51:00.577Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a95a1cffacd0203100297001719160160f443dd6"
        },
        {
          "url": "https://git.kernel.org/stable/c/5859cc01fee06a2cd7458905a9593082fbab06e1"
        }
      ],
      "title": "nfsd: ensure nfsd_file_do_acquire() does not use a non-opened file",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89687",
    "datePublished": "2026-09-11T19:46:08.630Z",
    "dateReserved": "2026-09-11T19:38:34.749Z",
    "dateUpdated": "2026-10-19T08:51:00.577Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.